Unknown Estatik Real Estate Plugin vulnerabilities

4 CVEs affecting Unknown Estatik Real Estate Plugin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76790, published 2026-09-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-14547, published 2026-08-06. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated…
CVE-2026-76790, published 2026-09-19. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX…
CVE-2026-16262, published 2026-08-07. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an…
CVE-2026-18044, published 2026-08-12. Low severity, CVSS 3.7. EPSS: 0.1% chance of exploitation in the next 30 days. The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing…